Is there a way to download security updates and notify admin without installing the update?

Question

We use apt to download and install security updates on our production server, and most of the time this works well for us. However, this morning, our server downloaded an update, installed the updates, and then restarted one of the services being updated. This service requires a manual input on restart - and apt cannot supply said input. This effectively knocked out our server for a brief period (only a few minutes, but still).

What I'd like to know - is there a way to get apt to download the update, but notify via email that there is an update rather than simply install and restart services?

It would be great if we could do this per service - but there aren't a high volume of security updates (looking at the logs) so that's not a deal-breaker.

Answer 1

Install the package unattended-upgrades:

sudo apt-get install unattended-upgrades

This will create the file /etc/apt/apt.conf.d/50unattended-upgrades

You may edit this file. Lines starting with // are comments.

You can comment out some lines, specifically:

1. You can list a package not to be updated:

   // List of packages to not update
   Unattended-Upgrade::Package-Blacklist {
       "my-blacklisted-package";
   
   };
   

2. You can send an email when updates are available:

   Unattended-Upgrade::Mail "root@localhost";
   

P.S. I don't think unattended-upgrades will download the update if it's not going to be installed. You can do that by editing /etc/apt/apt.conf.d/10periodic.

You can read the apt.conf example file (DO NOT USE this file as a whole, only bits of it): /usr/share/doc/apt/examples/configure-index.gz

Update-Package-Lists "0";
// - Do "apt-get update" automatically every n-days (0=disable)
//   
Download-Upgradeable-Packages "0";
// - Do "apt-get upgrade --download-only" every n-days (0=disable)
//
Unattended-Upgrade "0";
// - Run the "unattended-upgrade" security upgrade script 
//   every n-days (0=disabled)
//   Requires the package "unattended-upgrades" and will write
//   a log in /var/log/unattended-upgrades
//

P.P.S. You must set Unattended-Upgrade "1"; in /etc/apt/apt.conf.d/10periodic in order for unattended-upgrades to be enabled.